A user on our (openSuSE) linux systems attempted to run sudo, and triggered an alert. He has the environment variable EGG set -
This looks unusual to say the least.
Is EGG a legitimate environment variable? (I've found some references to PYTHON_EGG_CACHE - could be related? But that environment variable isn't set for this user). If it's legit, then I imagine this group has the best chance of recognizing it.
Or, given the embedded
/bin/sh in the string above, does anyone recognize this as an exploit fingerprint? It wouldn't be the first time we had a cracked account (sigh).